Maintainer of this skill?
Automated security scan — not a certification.
by pulseaiclub
A fast coding agent, rpc plugin, sub-agents, sloppy edits, and mcp
# Add to your Claude Code skills
git clone https://github.com/pulseaiclub/phiGuides for using ai agents skills like phi.
Last scanned: 8/13/2026
{
"issues": [
{
"file": "README.md",
"line": 41,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://raw.githubusercontent.com/pulseaiclub/phi/main/scripts/instal\"",
"severity": "low"
}
],
"status": "PASSED",
"scannedAt": "2026-08-13T05:41:49.552Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how phi compares with popular alternatives.
phi is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by pulseaiclub. A fast coding agent, rpc plugin, sub-agents, sloppy edits, and mcp. It has 993 GitHub stars.
Yes. phi passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/pulseaiclub/phi" and add it to your Claude Code skills directory (see the Installation section above).
phi is primarily written in Go. It is open-source under pulseaiclub on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh phi against similar tools.
No comments yet. Be the first to share your thoughts!
From $49 · 30 days · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
Install the latest release (macOS / Linux):
curl -fsSL https://raw.githubusercontent.com/pulseaiclub/phi/main/scripts/install.sh | bash
Windows (PowerShell 5.1+):
irm https://raw.githubusercontent.com/pulseaiclub/phi/main/scripts/install.ps1 | iex
First launch needs a model. Open the config editor (creates ~/.phi layout
and writes ~/.phi/config.yaml):
phi config
Or set env vars for a one-off run:
export PHI_MODEL=gpt-4o
export PHI_API_KEY=sk-...
Then start the TUI:
phi
Or build from source (Go 1.26.3+, see go.mod):
make build # produces ./phi
make install # build and install into $GOBIN
On first start, phi automatically creates ~/.phi/{bin,skills,hooks,session}. Search
tools (fd, rg) download into ~/.phi/bin in the background when missing.
The TUI gives the model four core tools — read, write, edit, and
bash — plus grep, find, and ls. The model uses these to
fulfill your requests. External HTTP fetch is available via MCP when configured.
Lean is not enough — phi is built to feel instant and stay cheap under load.
phi numbers are a stripped release build (CGO_ENABLED=0, -ldflags="-s -w")
on macOS arm64. Other harnesses use published Linux PSS / interactive PTY
figures.
| Metric | phi |
|---|---|
| Release binary | ~15 MB |
| Idle RSS (1 session) | ~21 MB |
| 10 idle sessions (total RSS) | ~221 MB |
| Time to first frame | ~31 ms (26–49 ms) |
Cold go build (empty GOCACHE) |
~5.5 s |
| Warm rebuild | ~0.7 s |
| Go source (excl. tests) | ~22k LOC / 107 files |
| Go packages | 32 |
| Direct module deps | 6 (15 modules total) |
| Linked runtimes | system libs only (no Node / Electron / Python) |
phi reads ~/.phi/config.yaml (standard YAML). Environment variables
override it for one-off runs. phi config opens a full-screen terminal editor
for the same file — nothing is written until you save, and the previous file is
kept as config.yaml.bak.
phi config keys
↑↓ ←→ move / cycle a value a add a model
⏎ edit or open a picker d delete the focused row
esc close, or quit f fetch model ids from the provider
^s save s save q quit
An empty field means "not set", i.e. the value the loader would fill in; the placeholder shows that value.
# ~/.phi/config.yaml
models:
- name: gpt-4o
api: OpenAI # OpenAI | OpenAIResponses | Anthropic | Gemini (empty → OpenAI-compatible)
api_key: sk-... # or set PHI_API_KEY
base_url: https://api.openai.com/v1 # default; PHI_BASE_URL overrides
context_window: 128000 # optional
default: true # the model used at startup; first entry wins if absent
- name: claude-sonnet-4-20250514
api: Anthropic # required — no name/URL guessing
api_key: sk-ant-...
base_url: https://api.anthropic.com
context_window: 200000
- name: deepseek-flash # built-in preset: base_url / context / thinking filled in
api_key: sk-...
- name: gemini-2.5-flash # built-in preset (api: Gemini)
api_key: ...
think_level: high # optional: off | minimal | low | medium | high | …
skill_path: ~/.phi/skills # where SKILL.md files are loaded from; "~/…" is expanded
agents:
enabled: true # default; set false to disable agent_* sub-agent tools
models: # optional per-role defaults; omit → inherit parent model
explore: cheap-model
review: strong-model
worker: coding-model
permissions:
mode: interactive # interactive | readonly | autopilot | headless-strict | allow-all
bash:
default: ask # ask | allow | deny
allow:
- "go test ./..."
deny:
- "rm -rf *"
rules: # extra rules; deny > ask > allow, always
- kind: read
resource: url
decision: ask
reason: external lookup needs approval
Built-in presets and thinking wire formats: doc/models.md.
Environment overrides:
| Variable | Overrides |
|---|---|
PHI_API_KEY |
models[].api_key (default model) |
PHI_MODEL |
models[].name (default model) |
PHI_BASE_URL |
models[].base_url (default model) |
PHI_SKILL_PATH |
skill_path |
PHI_THINK_LEVEL |
models[].think_level (default model; off disables) |
PHI_PROMPT_HISTORY |
Composer prompt recall (on enables; off by default, writes prompts.json in the project's session directory) |
Provider routing uses the explicit api field (OpenAI / Anthropic /
Gemini). See Supported models.
~/.phi/
├── config.yaml # global configuration
├── bin/ # downloaded search tools (fd, ripgrep)
├── skills/ # SKILL.md skill directories
├── extensions/ # PXB binaries + phi.yaml
├── jobs/ # sub-agent job artifacts (meta, logs, result.md)
└── session/ # persisted sessions, one dir per working directory
└── <encoded-cwd>/
phi starts the TUI: a chat transcript on top, an editor at
the bottom, and a footer with the current activity. When a newer release is
available, the footer shows a hint like 0.2.0 available · phi update.
Assistant output is rendered as Markdown (CommonMark/GFM): headings, emphasis,
strikethrough, links, blockquotes, lists, task checkboxes, and tables are
styled with the active theme; fenced code blocks get a muted language caption and per-language
syntax highlighting. Structural markers (#, `, *) are stripped.
The editor s